Kanoon SamjhoIndian law, made simple
Cyber Crime

Act fast

I shared an OTP or clicked a link by mistake. Will I get my money back?

Simple answer

Maybe not in full. Under RBI rules, if you shared your OTP or PIN, you usually bear the loss until you report it to the bank; after that, the bank does. Report to your bank and 1930 at once. From 1 January 2027, small losses can get part compensation.

Real-life examples

Lakshmi told a caller 'from the bank' her OTP, and ₹40,000 was taken. She reported it within an hour. Because she shared the OTP, the bank may hold her responsible for the ₹40,000, but any debit after her report is the bank's loss.

Anil never shared any details, but his card data was stolen from a hacked shopping website. He told his bank within two working days. This is a third-party breach, so he has zero liability, and the bank must credit the money within 10 working days.

What should you do?

  1. 1Call your bank's official helpline at once to block your card, UPI and net banking. Also call 1930.
  2. 2Report the fraud to the bank in writing (app, email or branch). Keep the complaint number, date and time — your reporting time decides your liability.
  3. 3Complete the complaint on cybercrime.gov.in and keep the acknowledgement number.
  4. 4Ask the bank in writing to reverse the amount. The bank must prove it was your fault, and must settle the complaint within 90 days.
  5. 5If the bank rejects it or doesn't reply within 30 days, complain to the RBI Ombudsman at cms.rbi.org.in.

Exceptions & limits

  • If the fraud happened because of the bank's own fault, such as a breach of its systems, you have zero liability even if you report late.
  • If you shared nothing and the leak happened elsewhere, you have zero liability if you report within 3 working days. In 4–7 working days, your loss is capped at ₹5,000–₹25,000, depending on the account.
  • From 1 January 2027 (commercial banks), new RBI rules apply. If you shared your OTP and lost up to ₹50,000, you can get one-time compensation of 85% of the loss, up to ₹25,000, if you report to the bank and 1930 within 5 calendar days.

Official legal reference

  • RBI circular: Customer Protection – Limiting Liability of Customers in Unauthorised Electronic Banking Transactions (6 July 2017)

    Zero liability for the bank's fault or a third-party breach reported within 3 working days; customer bears negligence losses until reporting; credit within 10 working days.

  • Reserve Bank of India (Commercial Banks – Responsible Business Conduct) Third Amendment Directions, 2026

    For transactions from 1 January 2027: zero liability for a third-party breach reported within 5 calendar days; one-time 85% compensation (max ₹25,000) for negligence losses up to ₹50,000.

  • Reserve Bank – Integrated Ombudsman Scheme, 2026

    If a bank, NBFC or payment company rejects your complaint or doesn't reply within 30 days, you can complain to the RBI Ombudsman within 90 days.

Where to get help

National Cyber Crime Helpline

Report online financial fraud immediately so the money trail can be frozen.

Call 1930cybercrime.gov.in

RBI Ombudsman (CMS)

Complain about a bank, NBFC or payment app if they don't resolve your complaint.

Call 14448cms.rbi.org.in

Source & status

Applies to
All of India
Law in force since
6 Jul 2017
Legal review
Draft — awaiting lawyer review

Educational information, not legal advice for your case. Exact facts and the law that applies matter — speak to a lawyer before acting.

Related questions